Data protection & security at waitrAI

• Your guests' data: When guests order from you or make a reservation via WhatsApp, you as the restaurant are the controller. We process this data only on your behalf and in accordance with your instructions. For this purpose, we conclude a Data Processing Agreement with you under Art. 28 GDPR.
• Your own data: We are ourselves the controller for your account, invoicing and support. More on this in the privacy policy.
• No own use: We do not use your guests' data for our own purposes, nor for advertising or for training AI models.

• Our database is located in the AWS region Frankfurt am Main. It is operated by our service provider Supabase.
• Some service providers also process data outside the EU, above all OpenAI in the USA. EU standard contractual clauses or the EU-US Data Privacy Framework apply to this. The list below names them individually.

Independent controllers (not processors): PayPal for guests' online payments, Google for the map check of delivery addresses.

• Stripe: invoicing of your subscription.
• Resend: sending reports by email.
• OpenAI: reading in menus.
• Supabase and Vercel: as above, also for your account.

Before we newly engage or replace a service provider for guest data, we inform you by email at least 30 days in advance. You may object on data protection grounds within 14 days, as provided in the Data Processing Agreement. Every change is listed with its date in the change history below.

Change history: 21 October 2026 – first version. 23 October 2026 – PDF.co removed (no longer used).

• What the AI does: It understands your guests' messages, answers questions about your restaurant and takes orders and reservations. During set-up, it reads in your menu.
• What it does not do: It does not finally accept orders and reservations; your team does that in the dashboard. Prices and allergens come exclusively from your approved menu.
• Notice to guests: At the start of the conversation, guests are told that an AI assistant is replying (Art. 50 of the EU AI Act).
• Model: We use OpenAI language models via their API. OpenAI does not use this data for training and stores it for up to 30 days for abuse detection.

The full list can be found in the annex on technical and organisational measures of the Data Processing Agreement. In brief:

• Encrypted transmission (TLS); the database is encrypted at rest (according to Supabase).
• Row-based access rules in the database separate the restaurants' data from one another.
• Access within the team only where necessary; manager area additionally protected by a PIN.
• We check incoming WhatsApp messages for a valid signature from Meta.
• Daily backup by Supabase with 7 days' retention (according to Supabase).

Supabase states that it has a SOC 2 report (Type 2) for its platform. waitrAI itself is not certified.

If you find a security vulnerability or suspect an incident, write to hello@waitrai.app. In the event of a data breach, we inform affected restaurants without undue delay, and at the latest within 36 hours, as provided in the Data Processing Agreement.

• Jurisdiction of the infrastructure: waitrAI Sp. z o.o. is subject to Polish law. The database runs at Amazon Web Services in Germany. Supabase has its registered office in Singapore, Amazon Web Services in the USA. Authorities of these countries could therefore demand access.
• Protection against government access from third countries: Storage in the EU, encryption in transit and at rest. Our service providers contractually undertake to review requests from authorities, to disclose only what is strictly necessary and to inform us, where permitted.

• Data Processing Agreement
• Privacy policy
• General Terms and Conditions